Behavioral task
behavioral1
Sample
NEAS.be4805940cf41618727abc6509cf9840.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.be4805940cf41618727abc6509cf9840.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.be4805940cf41618727abc6509cf9840.exe
-
Size
828KB
-
MD5
be4805940cf41618727abc6509cf9840
-
SHA1
b29a57ce31438de005af496b7dfb91c69ec6d36e
-
SHA256
0505840847320da260c6040e91081c1b27734b4360886c735bb96a912baa75ca
-
SHA512
50853871bb3a6e065f6c2a5321e76fbdf5981aafa204c1ace285a89a31775c627c8cfd99166ff0475d3b778dc47523f9b29572784983b19e919dbebb2b000054
-
SSDEEP
24576:SaC3h6iqFRr/t5o5b8hbh9T5e7f91+ZvN/lHJLg:46iqF1/oehh9te76lNdH1g
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NEAS.be4805940cf41618727abc6509cf9840.exe
Files
-
NEAS.be4805940cf41618727abc6509cf9840.exe.exe windows:4 windows x86
8c0ea4a60f6ad6159ba9bf997c1bbe75
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rasapi32
RasGetConnectStatusA
kernel32
FindClose
GetModuleHandleA
LoadLibraryA
VirtualAlloc
GetModuleFileNameA
ExitProcess
user32
ScreenToClient
MessageBoxA
gdi32
StartDocA
winmm
waveOutPrepareHeader
winspool.drv
DocumentPropertiesA
advapi32
RegQueryValueA
shell32
ShellExecuteA
ole32
CLSIDFromString
oleaut32
LoadTypeLi
comctl32
ord17
ws2_32
connect
wininet
InternetCloseHandle
comdlg32
ChooseColorA
Sections
.text Size: - Virtual size: 443KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 217KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 171KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: - Virtual size: 344KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.UPX1 Size: 804KB - Virtual size: 803KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ